Microsoft Researchers Uncover Lazarus Technique Backdooring AI Agents via Dormant Neurons

Microsoft researchers detailed an AI backdoor technique called Lazarus, showing how dormant neurons in large language models can be reprogrammed to compromise autonomous AI agents. The attack alters fewer than 10 dormant neurons directly in model checkpoints without retraining, enabling the model to pass standard safety evaluations while behaving normally until exposed to a trigger, such as a date change. When triggered, the model emits unauthorized instructions that the host agent executes using its granted system or terminal privileges. Microsoft stated that defending against such threats requires verifying model provenance, diffing weights against original releases, cryptographic signing, and auditing weights with frontier agents.

Key takeaways

• Modifying fewer than 10 dormant neurons without model retraining can backdoor an AI agent while maintaining normal behavior on standard evaluations.
• Upon encountering a specific trigger, the backdoored model can emit malicious instructions executed directly through the agent's tool or terminal permissions.
• The method requires only inference-level compute and checkpoint write access, making internally developed and open-weight models equally vulnerable if storage or pipelines are compromised.
• Microsoft highlighted defense-in-depth measures, including weight diffing against original sources, publisher verification, cryptographic signing, and agent-based weight scanning.